Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Monday, April 18, 2016
Wednesday, July 15, 2015
Another Brick In The (Fire)Wall Versus The Great Wall Of Red China! - IMRAN™
Another Brick In The (Fire)Wall Versus The Great Wall Of Red China! In 1998-1999 I had the privilege of being the first...
Posted by Imran Anwar on Wednesday, July 15, 2015
Wednesday, June 03, 2015
Love The Cloud With No Limits, But Know Your Limits!
I just read an article on Forbes' site where the writer correctly argued that despite the cost of cloud storage being nearly zero (who can compete with "Free!" ?) he likes to use personal networked storage at home for his data.
I agree with the points he makes about why using personal storage is still the better option versus cloud storage. But I disagree on the use of Network Attached Storage at home. No matter what device I have tried, no NAS at home comes close to the speed of a Thunderbolt, Firewire or USB3 external hard drive when doing regular and incremental backups of my Macs and MacBook Pros, as I do.
Coincidentally, one of the biggest problems I have with cloud storage is that despite buying cool utilities like ExpanDrive. which mount my Google, Box, DropBox OneDrive, FTP and other cloud storage on my Macs's desktops as local drives, none of them is writable from backup apps like Carbon Copy Cloner or Time Machine.
Additionally, the time it would take for my backups to complete even over my 75/75Mbps connections is another huge deterrent.
I personally carry 2 portable drives (one ThunderBolt and one USB3) with my laptops when I travel, while having multiple clones and Time Machine backups at both homes in NY and FL. Each is obviously encrypted with the highest level security, or I would be trading reliable backup with high risk of theft.
No matter what you do and what type of data you have, whether on a phone or a computer, you MUST backup your data, if you value your time, and your data. As Clint Eastwood would say, A man's gotta know his limits. So does a woman.
Can you afford to lose all the data on your device? Pictures? Messages? Emails? Contacts? How much spare time did God give you that you'd want to take on the burden of re-gathering all the contacts you have? And what about the photos? You do have them backed up somewhere, right?
Don't tell me you are relying on FaceBook as your personal album storage? What if someone hacks your account and deletes all your albums? Even worse, what if the FB policy Nazis don't like something you post and delete your account?
By the way, did you know that FaceBook turns your gorgeous 1-15MB photos taken with anything from a cell phone to a fancy camera into pure-crap-minimum-tolerable-quality 72 dpi files of merely 100-200KB? Good luck printing those if you ever want to in the future. Even a USB stick or two are so cheap these days. Not using at least a Thumb Drive is Dumb!
At the very least use something like Flickr, that stores the images at full size and gives you 1TB free. But check your security settings so none of your private photos become public. (Well, it is OK to give me access to see them. Purely for my giving you security advice of course. LOL).
Finally, remember, One is never enough, and as I also always say, Once Every Night isn't enough either. :-) I learned a long time ago that when a laptop drive dies, it will happen on the same day an external backup drive will also die ...and the backup of the backup will be unmountable on that same day. ;-)
So, backup on more than one system (external drive, thumb drive, CD/DVD/Blu Ray, cloud), with more than one method (data only, full clone, incremental timestamped backups), in more than one place (your home, your parents' home, across the country).
One day (or night) you will thank me for it!
Imran Anwar
Love The Unlimited Cloud, But Within Limits!™
Cloud 9 Global Inc.
IMRAN.TV
I agree with the points he makes about why using personal storage is still the better option versus cloud storage. But I disagree on the use of Network Attached Storage at home. No matter what device I have tried, no NAS at home comes close to the speed of a Thunderbolt, Firewire or USB3 external hard drive when doing regular and incremental backups of my Macs and MacBook Pros, as I do.
Coincidentally, one of the biggest problems I have with cloud storage is that despite buying cool utilities like ExpanDrive. which mount my Google, Box, DropBox OneDrive, FTP and other cloud storage on my Macs's desktops as local drives, none of them is writable from backup apps like Carbon Copy Cloner or Time Machine.
Additionally, the time it would take for my backups to complete even over my 75/75Mbps connections is another huge deterrent.
I personally carry 2 portable drives (one ThunderBolt and one USB3) with my laptops when I travel, while having multiple clones and Time Machine backups at both homes in NY and FL. Each is obviously encrypted with the highest level security, or I would be trading reliable backup with high risk of theft.
No matter what you do and what type of data you have, whether on a phone or a computer, you MUST backup your data, if you value your time, and your data. As Clint Eastwood would say, A man's gotta know his limits. So does a woman.
Can you afford to lose all the data on your device? Pictures? Messages? Emails? Contacts? How much spare time did God give you that you'd want to take on the burden of re-gathering all the contacts you have? And what about the photos? You do have them backed up somewhere, right?
Don't tell me you are relying on FaceBook as your personal album storage? What if someone hacks your account and deletes all your albums? Even worse, what if the FB policy Nazis don't like something you post and delete your account?
By the way, did you know that FaceBook turns your gorgeous 1-15MB photos taken with anything from a cell phone to a fancy camera into pure-crap-minimum-tolerable-quality 72 dpi files of merely 100-200KB? Good luck printing those if you ever want to in the future. Even a USB stick or two are so cheap these days. Not using at least a Thumb Drive is Dumb!
At the very least use something like Flickr, that stores the images at full size and gives you 1TB free. But check your security settings so none of your private photos become public. (Well, it is OK to give me access to see them. Purely for my giving you security advice of course. LOL).
Finally, remember, One is never enough, and as I also always say, Once Every Night isn't enough either. :-) I learned a long time ago that when a laptop drive dies, it will happen on the same day an external backup drive will also die ...and the backup of the backup will be unmountable on that same day. ;-)
So, backup on more than one system (external drive, thumb drive, CD/DVD/Blu Ray, cloud), with more than one method (data only, full clone, incremental timestamped backups), in more than one place (your home, your parents' home, across the country).
One day (or night) you will thank me for it!
Imran Anwar
Love The Unlimited Cloud, But Within Limits!™
Cloud 9 Global Inc.
IMRAN.TV
Tuesday, December 23, 2014
To Achieve Greatness In The Digital World, Respect Intellectual Property & Innovate, Or Be Irrelevant! - IMRAN™
The article (Tech In Pakistan 2014) in the reputable Pakistan newspaper, Dawn, makes good points lamenting the mind numbingly stupid, and self-destructive, policies and factors that make for such “tepid performance” in Pakistan. The author, Y. Brohi, points out how one does not need an army of people to launch a startup. My personal experience proved that, indeed, even one person can start a revolution or entire industries for others to build on.
At the end of the eighties and in the early 1990s, I was fortunate and blessed to pioneer and launch Internet email service in Pakistan right from my home in Gulberg-III, Lahore, while I was studying for my MBA at Columbia University Graduate School of Business in New York City. Together we, my then partner & neighbor Ashar Nisar and I, were able to launch the .PK ccTLD, literally putting Pakistan on the brave new digital world’s map.
I later also had the opportunity to make another, less known but also important, humble contribution to Pakistan’s economic progress, by bringing and launching global credit cards in Pakistan, starting with issuing the first MasterCard license to a Pakistani bank in the early 90s. The availability of credit to the middle class can be a major driver to drive economic activity and the creation of products, services and related jobs.
Both of those industries were launched with no government funding (actually, we succeeded despite resistance and other tactics of the authorities of that time that I will not mention), and without venture capital, which at that time was near impossible to get in Pakistan.
My reason for writing this is not to boast on past achievements but to exhort the dynamic and industrious Pakistani entrepreneurs to learn from what the article says and what my experience shows.
You, one person, can start anything you want. There is nothing stopping the next secure identity and privacy solution to be created in Pakistan. There is no reason that Pakistanis cannot pioneer artificial intelligence or secure cloud computing methods.
If there is one thing that I have been frustrated by, and feel is a core reason for Pakistanis not creating world changing new things, is the disregard for intellectual property rights and concepts. From people ripping DVD movies to kids ripping games without payment, to the shameless way so-called respectable newspapers (excluding Dawn) steal and reprint others’ creative output, theft of intellectual property is commonplace, and something people almost boast about.
How then can people think in terms of creating intellectual property if they are themselves busy stealing someone else's? That attitude is embedded in our culture and needs to be addressed. Without that, all the creative capabilities of Pakistanis will continue to be wasted on copying or reverse engineering others’ work, not creating brave new IP to change the world.
I would love to see that topic get discussed at a national level. There are few nations that have so much creative entrepreneurial talent than Pakistan, as I have seen in my ~30 years of traveling the world.
Let us find ways to stimulate that and channel that and guide that for the greater good of the creators and the nation. That is why, in speaking to groups of Pakistani entrepreneurs and technology professionals, I say, “To Achieve Greatness In A Digital World, Respect Intellectual Property And Innovate With Your Own, Or Be Irrelevant!”
IMRAN™
http://imran.pk
Sunday, July 22, 2012
Product Review: Eikon To Go USB Fingerprint Reader With Apple Mac + Windows Software
I have always believed in the convenience of biometric devices. They have been hard to come by on Macs, but for many years I have used and appreciated a fingerprint scanner (infrared pad to USB) from Microsoft, that only worked on Windows, though sadly now does not work in Windows 7.
This Eikon fingerprint scanner is a USB plug in type for the Mac and comes with Windows software also. I tested and use it on both platforms, after buying from Amazon.
The product itself gets 3 stars, but the 4th star is for the fact that they made the effort to develop it for Mac, and even more so for how absolutely wonderful both the seller (reseller) and the manufacturer were to my emails about the bugs and frustrations I encountered.
It is finicky, it often takes 2-3 slides of the finger(s) or one slow very accurate swipe for it to work. Often I wonder if the 2-3 attempts are worth the hassle of using the device. On the other hand (no pun intended) it does log me in quickly when I do it "right". Using it regularly and getting used to it provide the benefit that you can ( I did) make the password far more complex/long than when just typing it in my hand. E.g. &*mYpa$$word&*43!! Instead of just &*mYpas$$ etc.
The worst thing about the design is that it is useless to plug in to a typical MacBook Pro (i5 15" for this case) when anything else is plugged in. It is too wide. So, it comes with a maybe 6" USB extension, but then it makes it even less attractive, in visual and usage sense.
Now you have loose hanging thing twisted upside down or sideways sitting on the side of your laptop (as the cables often have an inherent 'twist' torque in them that flip the device on its side), and it is now even less usable as you almost have to grab is with one, hold it up firmly enough so you can swipe a finger from the other hand through it.
Since I use external USB keyboards with my MacBook Pros, I tried to plug it into the USB built in to Apple keyboards. No joy, as the device will not fit there and even if it did, it would be under the keyboard body and not usable. Hanging it by the USB tail extension I can use it but it will always move around, still requiring the 2 hand use, unless I scotch tape it. Then, it makes the laptop a little less mobile if I have to remove it every time I travel.
I am also disappointed that despite taking far more repetitions to learn a fingerprint than a 10 year old Microsoft infrared fingerprint reader (sadly not compatible with Mac or even Windows 7 now), it still needs the finger swipe to be so specifically accurate. But, it i doable, and when you get used to it, it does save time.
A plus is that I have it working on an office provided Windows 7 laptop. A disappointment is that it does not store finger prints on the device for MAC users. It does store the fingerprints for the Windows software! So, technically I think I can carry it to different Windows desktops/laptops without having to save fingerprints x 10 x 5 repetitions per finger on each machine, but for each Mac I would have to go through that process.
Based on just how cooperative the seller and the manufacturer have been, and the price, and overall tolerable usability, I am considering getting another unit so I can leave one taped to the desk and one to carry with me or use on the other laptop(s). Or, of course, I will be happy to buy the next great biometric device that comes out for my preferred platforms.
But please be aware of the shortcomings (and advantages) before you order this or similar devices.
Imran Anwar
Technorati: Apple, Macintosh, Microsoft, Security, Technology, Windows, MacBook, Biometrics, Gadgets
Thursday, May 03, 2012
CURES For Security Challenges In Cloud, Crowd, Big Data And The Big Bad World
An industry colleague and fellow blogger/journalist Mary Jander wrote an interesting article, "Security May Be Too Big a Job for IT" on Internet Evolution. It was a thought provoking post. Though I only see two comments on it at the time of writing this article, I am, for someone often taking contrarian views, quite in agreement with both Kim Davis and smkinoshita who wrote comments there. They talked about collaboration, and where the role of Security in an organization should lie.
With the advent of Cloud Computing, and more and more use of public, hybrid and public cloud converged infrastructures, one of the questions I am asked most often is, "Oh, is the cloud secure?"
Ironically, this is common between a housewife sitting on a flight next to me and a CEO that I may be advising.
"Nothing is secure, unless you make it a collaborative business of everyone in the enterprise to make it so," is what I, sometimes to their chagrin, bluntly tell them.
The problem is how Cloud Security, IT Security, Information Security, Data Security, Premises Security, Perimeter Security, XYZ Security, are still almost islands of imagined security unto themselves. This is not so much a technical limitation as an issue of three major distinct issues.
The first is due to enterprise architectures designed for the last century, or at best, for the last decade.
The second is the human element of doing management by dividing large entities into smaller pieces for easier management. That works great for operations, project management, etc. but is a terrible approach to security.
The third is a lack of collaboration (and integration) where it counts (end-to-end enterprise security) while organizational leaders patting themselves on the back for having rolled out some collaboration platform for sharing Word documents and Excel files.
This problem is not new. It goes back decades.
In 1999, as CEO of EverTrac, a pioneer of location-aware mobile information management & security, I was privileged to speak to top leaders at the United States Space & Missile Defense Command (I still get goosebumps at that name :-) and tell people to envisage Crystal Palace in one of my favorite childhood movies, War Games) at an Undisclosed Location in Alabama :-) .
But, excitement aside, I was surprised (and seriously concerned) when they were surprised at my saying they had to worry more about the information than about how to secure the servers and data centers, as they were focused on.
Even more, I said, they had to start thinking in terms of erasing boundaries between security departments -- not just in IT but even with and within non-IT. At the level of criical importance their Star Wars program was (and the nature of information today must be even more important and the threats even more nefarious and multifarious), not only would there be attempts, I said, to break in over the network, but physically, as well as various combinations.
The advent of mobile devices, global networks, hacking tools, complicated systems with often un-patched vulnerabilities, managed by people either lacking or not interested in keeping up with the latest iterations of technology and security challenges and solutions, all touching the cloud, make for an explosive mixture.
Even in 1999, I declared to my audience that these problems had CURES™.
I said Collaborative Unified Realtime Enterprise Security (collaboration was not yet a buzzword then) would be key to solving the problem before it became intractable. Sadly, 12-13 years later, even the top companies in private sector high information value businesses do not get it.
I continue to highlight this even more vociferously the more our lives generate, use, and are governed by, floods of big data, accessible to crowds large and small, all in a cloud with nebulous threats and security capabilities. I am glad others are taking up this serious problem.
Together, we can find the CURES!
Technorati Tags: Cloud, Cloud Computing, Security, Technology, Data, Space, Star Wars
Monday, October 10, 2011
The Morons Behind America's Next War... With Pakistan!
There's a so-called writer Steve Clemons at The Atlantic, who is probably on the CIA payroll, and writes articles to generate hate or negative opinion about whoever his puppet masters want to target for attack next. You can almost see the tails wag these dogs almost in unison in typical neo-con publications. His latest "article" is about "America's New War with Pakistan"...
You can almost imagine the conversation... "OK, what do you want me to write against them... OK.. Yes, please. The usual payment to the usual account. Thank you. Consider the article done and posted."
No surprise my comment below was deleted though it is neither offensive nor abusive.
I wonder what this writer's position was when now-terrorist former-hero Haqqani was a state guest in the White House with none other than US President Ronald Reagan... You know, that time not too long ago in a galaxy quite nearby, when US tax dollars were being spent to teach DDD (dead dog dictator) Zia how to crush democracy, create the ISI, fund black ops, and how to shove zealotry into a moderate Muslim Pakistan (and basket case Afghanistan) to make people consider the war against the Soviet occupiers an Islamic Jihad.
Ah, the irony, the irony. Good old fashioned conservative Christians in power funding with American tax payer money the creation of madrassahs and indoctrination programs, to teach young boys and men to kill or die fighting non-Muslim occupying armies....
Oooops, fast forward 30 years and that is our American soldiers now paying the price for that policy...
Once again, Pakistan was befriended when USA needed it, then used, abused, dumped it like a used Kleenex and now now, suddenly, puppet writers in many publications are writing op-eds about Pakistan as the new enemy.
So, so, predictable.
Imran Anwar
IMRAN.TV
http://blog.imran.com
Technorati Tags: Afghanistan, America, Christians, CIA, George Bush, IMRAN, Imran Anwar, ISI, Pakistan, Politics, Ronald Reagan, Security, Taliban, USSR, War
You can almost imagine the conversation... "OK, what do you want me to write against them... OK.. Yes, please. The usual payment to the usual account. Thank you. Consider the article done and posted."
No surprise my comment below was deleted though it is neither offensive nor abusive.
I wonder what this writer's position was when now-terrorist former-hero Haqqani was a state guest in the White House with none other than US President Ronald Reagan... You know, that time not too long ago in a galaxy quite nearby, when US tax dollars were being spent to teach DDD (dead dog dictator) Zia how to crush democracy, create the ISI, fund black ops, and how to shove zealotry into a moderate Muslim Pakistan (and basket case Afghanistan) to make people consider the war against the Soviet occupiers an Islamic Jihad.
Ah, the irony, the irony. Good old fashioned conservative Christians in power funding with American tax payer money the creation of madrassahs and indoctrination programs, to teach young boys and men to kill or die fighting non-Muslim occupying armies....
Oooops, fast forward 30 years and that is our American soldiers now paying the price for that policy...
Once again, Pakistan was befriended when USA needed it, then used, abused, dumped it like a used Kleenex and now now, suddenly, puppet writers in many publications are writing op-eds about Pakistan as the new enemy.
So, so, predictable.
Imran Anwar
IMRAN.TV
http://blog.imran.com
Technorati Tags: Afghanistan, America, Christians, CIA, George Bush, IMRAN, Imran Anwar, ISI, Pakistan, Politics, Ronald Reagan, Security, Taliban, USSR, War
Monday, September 12, 2011
Have American Airlines Pilots Become Paranoid Bathroom Attendants?
Like everyone else, I was seriously concerned about the threat of new terror attacks on the 10th Anniversary of September 11. I was more worried about vehicle borne or even lone wolf suicide bombings than someone still managing to pull off a terror attack using jet airliners.
So, I read with interest the news reports of two separate planes that caused national security alerts, with fighter jets being scrambled, and passengers being questioned, after landing, for their… drum roll… extended use of the airliner toilets.
A news item in particular was very strange… An American Airlines "pilot became nervous when he noticed that several passengers were making frequent trips to the bathroom."
I am all for safety and being alert, especially on the 10th anniversary of 9/11, but what kind of airliner pilot is more focused on how many people are going to the bathroom than flying the darn plane? Is he SuperPilot that he can see through the locked cockpit door? Or did some ditsy (male or female) flight attendant cause the scare? They should consider taking a job in a restaurant to keep track of bathroom visits by patrons.
Also, I am all for a couple deciding to make out on planes, trains and automobiles, but (if that is indeed what had happened on a Frontier Airlines flight) for a couple to try pulling that off (no pun intended) in an aircraft toilet on 9/11 suggests the Moron gene's presence.
Maybe airlines should not issue coupons (like drink coupons) on how many times and for how long passengers can go to the bathroom. eBay can set up a new marketplace to trade in toilet time futures.
A separate news report during the hunt for possible terror plotters mentioned how police were searching for stolen vans and similar vehicles.
That made me think… how dumb must be those retards who would steal any vehicle, much less a potential bomb-carrying-capable van on or around 9/11. I really wish they get caught, and even if they're simply Grand Theft Auto fans, I hope they are shipped to Guantanamo for the crime of being extra stupid, and for causing extra concern for the whole nation.
Finally, I am thankful that 9/11 2011 passed solemnly and uneventfully from a security perspective, but I remain concerned, and we must remain vigilant. We are not out of danger, and we are all in this together.
What were your thoughts on 9/11/2011 and how have your thinking and you changed since 9/11/2001 ?
Technorati Tags: Aircraft, Airlines, AlQaeda, Aviation, Flying, IMRAN, Imran Anwar, New York, Opinion, Pilots, Security,Terrorism, Travel, Commentary, 9/11
So, I read with interest the news reports of two separate planes that caused national security alerts, with fighter jets being scrambled, and passengers being questioned, after landing, for their… drum roll… extended use of the airliner toilets.
A news item in particular was very strange… An American Airlines "pilot became nervous when he noticed that several passengers were making frequent trips to the bathroom."
I am all for safety and being alert, especially on the 10th anniversary of 9/11, but what kind of airliner pilot is more focused on how many people are going to the bathroom than flying the darn plane? Is he SuperPilot that he can see through the locked cockpit door? Or did some ditsy (male or female) flight attendant cause the scare? They should consider taking a job in a restaurant to keep track of bathroom visits by patrons.
Also, I am all for a couple deciding to make out on planes, trains and automobiles, but (if that is indeed what had happened on a Frontier Airlines flight) for a couple to try pulling that off (no pun intended) in an aircraft toilet on 9/11 suggests the Moron gene's presence.
Maybe airlines should not issue coupons (like drink coupons) on how many times and for how long passengers can go to the bathroom. eBay can set up a new marketplace to trade in toilet time futures.
A separate news report during the hunt for possible terror plotters mentioned how police were searching for stolen vans and similar vehicles.
That made me think… how dumb must be those retards who would steal any vehicle, much less a potential bomb-carrying-capable van on or around 9/11. I really wish they get caught, and even if they're simply Grand Theft Auto fans, I hope they are shipped to Guantanamo for the crime of being extra stupid, and for causing extra concern for the whole nation.
Finally, I am thankful that 9/11 2011 passed solemnly and uneventfully from a security perspective, but I remain concerned, and we must remain vigilant. We are not out of danger, and we are all in this together.
What were your thoughts on 9/11/2011 and how have your thinking and you changed since 9/11/2001 ?
Technorati Tags: Aircraft, Airlines, AlQaeda, Aviation, Flying, IMRAN, Imran Anwar, New York, Opinion, Pilots, Security,Terrorism, Travel, Commentary, 9/11
Monday, November 29, 2010
On Securely Making Cloudy Claims About Cloud Security
PC World reported on the speech by a former hacker known as MafiaBoy, who was arrested for lots of insidious activities. Now, he was a guest speaker, in Toronto, Canada, at a forum organized by a well-known Japanese storage vendor.
His contention was that Cloud Computing has serious security vulnerabilities and that Security is an afterthought among vendors.
I am certain the reformed hacker is a very, very, smart man. I am positive, no amount of security can be enough to ever guarantee perfection. However, the whole approach and message was a bit yawn-inducing for me. He was restating the obvious, wrapped in a bit of irresponsible FUD (fear, uncertainty, doubt), with a ribbon of future "I told you so" claims tying it up nicely.
That is like someone being arrested for throwing medical trash into a town's water tank, and then going on CNN or Fox News Channel to make a generalized claim, like, "There are serious vulnerabilities in our whole nation's public drinking water supply." That person can then sit back while people wonder if they should all be drinking bottled water only.
Some of the other contentions of people who like hearing that kind of message, commenting at the PC World site, were that Cloud Computing is nothing but Client Server with a new label. OK, if someone said Cloud Computing is sort of like On-Demand Computing — but with both the ON and the DEMAND parts kicked into high gear in the marketplace — I would have agreed a bit.
Yes, of course, many of the concepts of Cloud Computing are derived from the evolution of previous computer system architectures and paradigms. But, if Cloud Computing is exactly the same as Client-Server, then it is even more "same" as mainframes and dumb terminals of yester-century.
For the first time in modern history, the true power of the Internet can be harnessed by every one, and every business, at every level, for almost every function, with the same type of access previously only giant multinationals could afford.
Even with the Internet boom, the overall benefits to us, ordinary people, were limited in type and scope.
We could enjoy email accounts of our own. With a bit of web hosting, using $5 per month packages, we could put up web sites as slick as the biggest multinationals (whether someone ever visited our web sites or not).
But, we could not venture into scaling beyond those basic limits.
A company with 20 employees could not afford true ERP or CRM solutions. An art movie studio with 5 creators could not expect to take on a movie requiring 10,000 hours of rendering time, without their idea being passe' while their 5 PCs or Apple Macs chugged along for 5 years.
Now they can rent software as a service (SaaS), platform as a service (PaaS), or a ton of infrastructure as a service (IaaS) as and when they need, without needing a million Dollars budget.
These, and countless other, aspects of cloud computing are leveling the playing field for individuals and the smallest businesses, which no Client Server solution did.
The benefits big business are gaining from Cloud Computing are even more obvious. From hardware and software license cost savings, to energy savings, to better utilizing available resources with available headcount, reducing total cost of ownership for once without having to resort to the typical head count reductions of past years, are just a few. Quick provisioning of application development and test environments, in hours, affordably, and then spooling it down, are additional examples.
So, going back to our esteemed and honorable ex-hacker's contentions about Security, let's ask: Is Security important? No. It is not important, it is ESSENTIAL.
But, for anyone to say that Cloud vendors are thinking of security as an afterthought is absolutely ridiculous. It is even more silly posturing than politicians of all parties typically indulge in, with meaningless statements that raise their audiences' fear levels. Just recently I wrote a popular item, which discussed the Cloud Security Alliance's good work, especially in the area of enabling greater levels of governance, risk management and compliance in Cloud.
An important thing to keep in mind is that Next Generation Data Centers, with highly converged and virtualized infrastructures, are not being created out of thin air, with paper, glue and paint. They are being created by integrating, and hardening, existing parts of the solution stack - virtualization, network, compute, and storage.
None of these elements consists of some untested new gadget created in a lab by two geeks and their dog. Each element has industry leaders, and strong competitors. Each has its own security postures, needs and mechanisms. And, vendors who are putting together the entire vertical stack, either from in-house, or partner technologies, are all working to build additional wrappers of Security. Trusted Multi-Tenancy, authentication and access control, encryption of data at rest and in flight, are just some examples of additional wrappers being built around the "core-stack" and what is in the "box".
Is this all perfect? Of course not? But, even the most secure, non-cloud, current data centers of big corporations have shown how Security can be breached.
From millions of credit card numbers being stolen, to WikiLeaks, even when Security is the most talked about topic, e.g. in financial services, government, military, healthcare, etc., some "misguided" (read malicious) person can find a way into any system, or may already be inside the system (as an employee).
What is required is for people like the former hacker to specify examples of where they see major vulnerabilities, how they would fix them, or how they suggested the fix and some vendor(s) or clients did not listen. I will be happy to take him to industry leaders at industry leading companies even better known than the large firm he was a guest of.
But, then, he better have some specific risks and vulnerabilities identified, with specific recommendations and proposed solutions. Otherwise, there are plenty of people who can sit outside complaining about a "problem" without being part of a "solution." Who has got time for those.
What do you think vendors need to pay more attention to, immediately, to make Cloud Computing more secure?
===
Imran Anwar is founder of Internet email in Pakistan, co-founder and co-owner of the .PK ccTLD of Pakistan, and founder of the credit card industry there. As a New York based technology, cloud computing, strategy, marketing, media and business professional he is often seen and heard on global media like CNN, Fox News, Express TV, WWRL and many others. These are Imran's personal opinions and do not necessarily reflect those of any employer, parent company, client, family member or other persons or organizations. Phew!
Technorati Tags: cloud, computing, Imran Anwar, technology, Cloud Computing, IMRAN, Imran Anwar, Security, Technology, Strategy
Wednesday, November 17, 2010
Governing Governance, Risking Risky Analysis Paralysis & Complying With Compliance In Successful Cloud Computing Initiatives
The Cloud Security Alliance, just announced a new stack to address issues of governance, risk management and compliance for the nascent but exploding cloud computing industry. InformationWeek has a good short news report on the subject.
I consider this welcome news, from two perspectives - as an individual professional opinion; and as the opinion of someone leading vertical solutions and service provider offers planning & management, at an industry-leader cloud technology company.
Cloud Computing has been fortunate that its hype only slightly exceeded the real world benefits it provides, and its ad-hoc, vendors and clients deciding what's best for them, implementation of governance, risk and compliance management were "just good enough" to keep the ball rolling. For early adopters, and for those seeking immediate TCO (Total Cost of Ownership) and ROI (Return On Investment) value of next generation data center models, with highly converged virtualized infrastructure, this was not a show stopper.
But, for the Cloud industry to evolve to the next stage, where it literally can explode to the stage, which would make the latest set of analyst predictions, such as those quoted in the article above, actually likely to come true, governance, risk and compliance issues had to be addressed sooner rather than later.
The challenge in every new paradigm (or even what some consider a repackaged old paradigm enabled by technology capabilities that enable the concept to take off this time) is to balance between extremes along those three lines of concerns.
I have called attention to these topics in the past in print and online. My concern has been that overly excited buyers, and sell-at-all-costs vendors could lead to risky behavior on one side of the spectrum, while analysis paralysis would keep a huge majority from losing out on the benefits of cloud computing.
What is needed, as I have said before, is a pragmatic and practical approach; rather than utopian and impossible drives for perfection, that cannot be achieved in one, much less, three areas of importance like GRC. Add to that the complexity and impossibility of agreement, a situation in which every stakeholder brings their own colored and colorful viewpoint.
The need is for comprehensive, but not onerous, approaches to governance; risk management without seeking absolute, "perfect", impossible to achieve, levels of "zero risk"; and compliance standards that enable enterprise and service provider moves to cloud models, rather than being roadblocks. These are are all essential steps without tripping up clients or vendors.
The CSA's latest contribution to successfully achieving these is a free GRC stack, a set of toolkits, for enterprise customers, vendors of cloud & security solutions, as well as those tasked with auditing IT. The toolkits are, Cloud Audit, Cloud Controls Matrix and the Consensus Assessments Initiative Questionnaire (Apparently they did not spend much time on coming up with a better name for this last one!). You can download the GRC stack free.
This is not, by any stretch of the imagination, GRC nirvana. There will be many significant areas, from Department of Defense related federal requirements, to the extremely granular levels of security an increasingly networked global financial system requires, and many others.
But, I hope, and remain confident, that this will be the first in an ongoing series of steps towards ever-improving quality of governance, risk management and compliance standards, which will help cloud vendors and users alike.
—
Technorati Tags: IMRAN, Imran Anwar, Technology, Cloud, Cloud Computing, Compliance, Risk, Governance
I consider this welcome news, from two perspectives - as an individual professional opinion; and as the opinion of someone leading vertical solutions and service provider offers planning & management, at an industry-leader cloud technology company.
Cloud Computing has been fortunate that its hype only slightly exceeded the real world benefits it provides, and its ad-hoc, vendors and clients deciding what's best for them, implementation of governance, risk and compliance management were "just good enough" to keep the ball rolling. For early adopters, and for those seeking immediate TCO (Total Cost of Ownership) and ROI (Return On Investment) value of next generation data center models, with highly converged virtualized infrastructure, this was not a show stopper.
But, for the Cloud industry to evolve to the next stage, where it literally can explode to the stage, which would make the latest set of analyst predictions, such as those quoted in the article above, actually likely to come true, governance, risk and compliance issues had to be addressed sooner rather than later.
The challenge in every new paradigm (or even what some consider a repackaged old paradigm enabled by technology capabilities that enable the concept to take off this time) is to balance between extremes along those three lines of concerns.
I have called attention to these topics in the past in print and online. My concern has been that overly excited buyers, and sell-at-all-costs vendors could lead to risky behavior on one side of the spectrum, while analysis paralysis would keep a huge majority from losing out on the benefits of cloud computing.
What is needed, as I have said before, is a pragmatic and practical approach; rather than utopian and impossible drives for perfection, that cannot be achieved in one, much less, three areas of importance like GRC. Add to that the complexity and impossibility of agreement, a situation in which every stakeholder brings their own colored and colorful viewpoint.
The need is for comprehensive, but not onerous, approaches to governance; risk management without seeking absolute, "perfect", impossible to achieve, levels of "zero risk"; and compliance standards that enable enterprise and service provider moves to cloud models, rather than being roadblocks. These are are all essential steps without tripping up clients or vendors.
The CSA's latest contribution to successfully achieving these is a free GRC stack, a set of toolkits, for enterprise customers, vendors of cloud & security solutions, as well as those tasked with auditing IT. The toolkits are, Cloud Audit, Cloud Controls Matrix and the Consensus Assessments Initiative Questionnaire (Apparently they did not spend much time on coming up with a better name for this last one!). You can download the GRC stack free.
This is not, by any stretch of the imagination, GRC nirvana. There will be many significant areas, from Department of Defense related federal requirements, to the extremely granular levels of security an increasingly networked global financial system requires, and many others.
But, I hope, and remain confident, that this will be the first in an ongoing series of steps towards ever-improving quality of governance, risk management and compliance standards, which will help cloud vendors and users alike.
—
Imran Anwar is founder of Internet email in Pakistan, co-founder and co-owner of the .PK ccTLD of Pakistan, and founder of the credit card industry there. As a New York based technology, media and business professional he is often seen and heard on global media like CNN, Fox News, Express TV, WWRL and many others. These are Imran's personal opinions and do not necessarily reflect those of any employer, employer's parent companies, clients, family members or other persons or organizations. Phew!
Technorati Tags: IMRAN, Imran Anwar, Technology, Cloud, Cloud Computing, Compliance, Risk, Governance
Thursday, June 26, 2008
In Defense Of Self Defense & Supreme Court Shooting Down DC Gun Laws
It was a split decision, but at last and at least the Supreme Court of the United States has taken a stand on the American Constitution.
Sadly, it has not had much to say on violations of the Constitution carried out by the Bush regime, nor taken any stand on the daily decline in our constitutionally protected rights.
More important to them than the Constitution being torn to shreds were Washington, DC (District of Columbia) gun laws that ban legal ownership of guns by DC citizens.
Mind you, DC, among other cities, has often vied for the Murder Capital of the World title. So, I can see the local law enforcement's logic in trying to ban guns (for the last 32 years). But, both as someone born in Pakistan and having been taught to handle my father's favorite Webley & Scott revolver, and now as an American with an affinity for Smith & Wesson/Walther devices, I fully support the right of Americans to bear arms.
Of course, the NRA, of which I should be a member but am not, would probably disagree with my contention that there do have to be some limits on the types, and possibly even number, of guns we can or should be allowed to own.
I support the right to bear arms for several reasons.
My interest in owning weapons includes having them for target shooting, self-defence and all that the Constitution intended as good reasons to bear arms.
However, I also do not think we, or any non-law-enforcement citizen, need some sort of 3000 rounds per minute assault rifle or machine gun to do all of the things above.
We live in unsafe times. Security of the homeland means protecting ourselves not just from would be suicide-bombers but also from armed home invaders, drug dealers, road-rage-warriors, thugs, muggers, petty criminals, gang members, and so many other types of vile scum that can easily snuff out our lives for a few Dollars, or on a whim.
So, I do support the Supreme Court decision shooting down the DC gun laws, but I also hope for two more things.
The Supreme Court, and American courts in general, should also not hobble American law-enforcement from coming down hard on hard core criminals who often brazenly conduct their business better armed than our Police officers.
Of course, it would also be nice if the Supreme Court actually did something more to protect the whole Constitution itself from our increasingly fascist dictatorial executive branch and lame, crippled Congress, and spineless Senate, and not just try to address one particular aspect of the Constitution. What do you think?
Sadly, it has not had much to say on violations of the Constitution carried out by the Bush regime, nor taken any stand on the daily decline in our constitutionally protected rights.
More important to them than the Constitution being torn to shreds were Washington, DC (District of Columbia) gun laws that ban legal ownership of guns by DC citizens.
Mind you, DC, among other cities, has often vied for the Murder Capital of the World title. So, I can see the local law enforcement's logic in trying to ban guns (for the last 32 years). But, both as someone born in Pakistan and having been taught to handle my father's favorite Webley & Scott revolver, and now as an American with an affinity for Smith & Wesson/Walther devices, I fully support the right of Americans to bear arms.
Of course, the NRA, of which I should be a member but am not, would probably disagree with my contention that there do have to be some limits on the types, and possibly even number, of guns we can or should be allowed to own.
I support the right to bear arms for several reasons.
My interest in owning weapons includes having them for target shooting, self-defence and all that the Constitution intended as good reasons to bear arms.
However, I also do not think we, or any non-law-enforcement citizen, need some sort of 3000 rounds per minute assault rifle or machine gun to do all of the things above.
We live in unsafe times. Security of the homeland means protecting ourselves not just from would be suicide-bombers but also from armed home invaders, drug dealers, road-rage-warriors, thugs, muggers, petty criminals, gang members, and so many other types of vile scum that can easily snuff out our lives for a few Dollars, or on a whim.
So, I do support the Supreme Court decision shooting down the DC gun laws, but I also hope for two more things.
The Supreme Court, and American courts in general, should also not hobble American law-enforcement from coming down hard on hard core criminals who often brazenly conduct their business better armed than our Police officers.
Of course, it would also be nice if the Supreme Court actually did something more to protect the whole Constitution itself from our increasingly fascist dictatorial executive branch and lame, crippled Congress, and spineless Senate, and not just try to address one particular aspect of the Constitution. What do you think?
Sunday, April 13, 2008
Snooping On Big Brother Snoops So Easy
I am a frequent reader of ComputerWorld for many years. It often offers good news and analysis on technology as well as technology related issues. One of the areas that is of interest to almost everyone with a job that requires using a computer (isn't that everyone these days?) is employers needing to or choosing to monitor on (or spy on?) the PC and net activities of employees. Jaikumar Vijayan has written an interesting article in the April 7, 2008 issue of ComputerWorld, titled "IT 'Big Brothers' trying to keep internal users under control".
One thing most of my readers know quite clearly, is that I am a big proponent of personal liberty, freedom of speech and privacy - citizen rights that the Bush administration has worked hard to destroy for the last eight years. However, on the topic of employers' rights to monitor to employees' use of the computer and network, I fully support employers. A PC is given to employees to do work for the business, not as a personal tool.
Sure, most, if not all of us, have had to use the office computer to login to a bank's web site to pay a credit card bill, or to send a quick email from hotmail or mac.com Mail. However, that is quite clearly not abuse and I know of few employers who would target such use as abuse. (I am sure if the email being sent was sexually explicit or otherwise inappropriate, employers could find that objectionable).
But, such one-off "urgent issue" type personal use does not mean an employee has the right to be sitting writing personal emails, trading stocks, watching online videos, visiting porn sites or chatting with buddies during the hours he or she is being paid to do work.
That means more and more companies are using automated and semi-automated tools and policies to monitor use of their IT resources. ComputerWorld's article (currently available at this link) makes some great points and talks about some products. It starts off by speaking about a technology manager named Tom Scocca at some big company that he did not want identified.
But even before reading the complete article I had to laugh at the silliness of stating "Scocca, (who) asked that his employer not be named."
Don't these "Big Brother" snoops know that anyone with a PC can be snooping on them as easily. Suppose one of the people mentioned in this story was really protecting something seriously important. It is laughable to think that a person seriously targeting him or his company can not reverse snoop on him.
Tom Scocca is most likely the same person who can easily be found on the Internet as being the Senior Security Manager at Applied Materials. Since it can established that this person worked at Cisco, and may have attended Santa Clara University.
We can easily see the company proudly tell us that: Applied Materials, Inc. designs, manufactures, and sells semiconductor fabrication equipment worldwide. It operates in four segments: Silicon, Fab Solutions, Display, and Adjacent Technologies. The Silicon segment provides a range of manufacturing equipment used to fabricate semiconductor chips or integrated circuits.
Even without us feeling like being in a Mission Impossible type movie, an attacker could even speculate or analyze what Tom's attitudes or exposure to technology or even technology philosophy is by doing further research on his past job and even the courses he may have taken in the past. I think the biggest problem is that our IT managers today may be so focused on targeting small fish, they may not even know they are in the bite-path of hungry data sharks themselves.
Food for thought.
One thing most of my readers know quite clearly, is that I am a big proponent of personal liberty, freedom of speech and privacy - citizen rights that the Bush administration has worked hard to destroy for the last eight years. However, on the topic of employers' rights to monitor to employees' use of the computer and network, I fully support employers. A PC is given to employees to do work for the business, not as a personal tool.
Sure, most, if not all of us, have had to use the office computer to login to a bank's web site to pay a credit card bill, or to send a quick email from hotmail or mac.com Mail. However, that is quite clearly not abuse and I know of few employers who would target such use as abuse. (I am sure if the email being sent was sexually explicit or otherwise inappropriate, employers could find that objectionable).
But, such one-off "urgent issue" type personal use does not mean an employee has the right to be sitting writing personal emails, trading stocks, watching online videos, visiting porn sites or chatting with buddies during the hours he or she is being paid to do work.
That means more and more companies are using automated and semi-automated tools and policies to monitor use of their IT resources. ComputerWorld's article (currently available at this link) makes some great points and talks about some products. It starts off by speaking about a technology manager named Tom Scocca at some big company that he did not want identified.
But even before reading the complete article I had to laugh at the silliness of stating "Scocca, (who) asked that his employer not be named."
Don't these "Big Brother" snoops know that anyone with a PC can be snooping on them as easily. Suppose one of the people mentioned in this story was really protecting something seriously important. It is laughable to think that a person seriously targeting him or his company can not reverse snoop on him.
Tom Scocca is most likely the same person who can easily be found on the Internet as being the Senior Security Manager at Applied Materials. Since it can established that this person worked at Cisco, and may have attended Santa Clara University.
We can easily see the company proudly tell us that: Applied Materials, Inc. designs, manufactures, and sells semiconductor fabrication equipment worldwide. It operates in four segments: Silicon, Fab Solutions, Display, and Adjacent Technologies. The Silicon segment provides a range of manufacturing equipment used to fabricate semiconductor chips or integrated circuits.
Even without us feeling like being in a Mission Impossible type movie, an attacker could even speculate or analyze what Tom's attitudes or exposure to technology or even technology philosophy is by doing further research on his past job and even the courses he may have taken in the past. I think the biggest problem is that our IT managers today may be so focused on targeting small fish, they may not even know they are in the bite-path of hungry data sharks themselves.
Food for thought.
Tuesday, January 29, 2008
Rude Giuliani Out, Florida Voters Got This One Right
While Florida voters may have been the butt of many jokes for the last 8 years - that just happen to coincide with the George W. Bush presidency - at least the Republican primary voters got one thing right.
They brought to an end the implausible, and frankly, embarrassing, attempt of a third-rate politician like Rudy Giuliani to run for President.
Most people know where I stand on that, as I wrote less than one year ago.
Nothing can make up for the damage my Floridian friends did to the USA in enabling Bush to get selected by the Supreme Court. But at least the Republican voters in Florida sent Giuliani packing, back to New York.
Now he can go back to making money by cashing in on 9/11 some more.
Ideally, he and Kerik would both be cell-mates somewhere.
But that may only happen in some parallel universe somewhere else.
For now, Giuliani Out is the best piece of news for our nation.
They brought to an end the implausible, and frankly, embarrassing, attempt of a third-rate politician like Rudy Giuliani to run for President.
Most people know where I stand on that, as I wrote less than one year ago.
Nothing can make up for the damage my Floridian friends did to the USA in enabling Bush to get selected by the Supreme Court. But at least the Republican voters in Florida sent Giuliani packing, back to New York.
Now he can go back to making money by cashing in on 9/11 some more.
Ideally, he and Kerik would both be cell-mates somewhere.
But that may only happen in some parallel universe somewhere else.
For now, Giuliani Out is the best piece of news for our nation.
Thursday, August 04, 2005
"Didn't Bin Laden work for the CIA?" . "Well,...."
Someone asked recently, "Didn't Bin Laden work for the CIA? Didn't they train him and give him loads of money?"
Well, I do not think Bin Laden was technically a direct recruit of the CIA or an employee.
I understand he went to Afghanistan on his own to fight the Russians, for their invasion of a Muslim land. US said he is a good man for feeling that way.
The CIA and the US Govt. were busy actually promoting the word JIHAD in Muslim countries like Pakistan so uneducated masses could be exhorted to volunteer to go into battle against Russians, many times knowing they would be suicide missions. So, Bin Laden was a Godsend to the CIA and they worked well together. Training and resources were surely provided to him.
Of course, now we are paying the price. We said he was a hero when he wanted outside armies out of Muslim lands like Afghanistan. When he said OK, now American armies out of Saudi Arabia (his actual home country)Blair and Bush started talking as if this is some ideology from 1000 years ago. Now, last time I checked 1979 was not 1000 yers ago when the US Govt. and CIA created the JIHADI soldier.
The Russians are probably laughing at us every day we get mad dogs we trained biting at us around the world now.
Imran
Post date: Aug 4, 2005
Well, I do not think Bin Laden was technically a direct recruit of the CIA or an employee.
I understand he went to Afghanistan on his own to fight the Russians, for their invasion of a Muslim land. US said he is a good man for feeling that way.
The CIA and the US Govt. were busy actually promoting the word JIHAD in Muslim countries like Pakistan so uneducated masses could be exhorted to volunteer to go into battle against Russians, many times knowing they would be suicide missions. So, Bin Laden was a Godsend to the CIA and they worked well together. Training and resources were surely provided to him.
Of course, now we are paying the price. We said he was a hero when he wanted outside armies out of Muslim lands like Afghanistan. When he said OK, now American armies out of Saudi Arabia (his actual home country)Blair and Bush started talking as if this is some ideology from 1000 years ago. Now, last time I checked 1979 was not 1000 yers ago when the US Govt. and CIA created the JIHADI soldier.
The Russians are probably laughing at us every day we get mad dogs we trained biting at us around the world now.
Imran
Post date: Aug 4, 2005
Subscribe to:
Posts (Atom)